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DETAILED ACTION 
Response to Arguments 

1 . Applicant's arguments with respect to claims 1-20 have been considered but are 
moot in view of the new ground(s) of rejection". 

Specification 

2. Specification is objected under 37 CFR 1 .75 because the term "One computer- 
recordable storage medium" in claims 8-10, is not defined in the specification. 
Appropriate correction is required. 

Claim Rejections - 35 USC § 101 

35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claims 11-20 are rejected under 35 U.S.C. 101 because claims 11-20 contain no 
hardware. Thus, the claims lack the necessary physical articles or objects to constitute 
a machine or a manufacture within the meaning of 35 USC 101 . They are clearly not a 
series of steps or acts to be a process nor are they a combination of chemical 
compounds to be a composition of matter. As such, they fail to fall within a statutory 
category. They are, at best, functional descriptive material perse. 



Application/Control Number: 10/796,317 
Art Unit: 2163 



Page 3 



Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth 
in section 1 02 of this title, if the differences between the subject matter sought to be patented and the 
prior art are such that the subject matter as a whole would have been obvious at the time the invention 
was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability 
shall not be negatived by the manner in which the invention was made. 

This application currently names joint inventors. In considering patentability of 
the claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of 
the various claims was commonly owned at the time any inventions covered therein 
were made absent any evidence to the contrary. Applicant is advised of the obligation 
under 37 CFR 1 .56 to point out the inventor and invention dates of each claim that was 
not commonly owned at the time a later invention was made in order for the examiner to 
consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 
prior art under 35 U.S.C. 103(a). 

3. Claims 1-7, 11 and 13-19 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Nareddy et al. (US Patent No. 7,107,338 B1, hereinafter "Nareddy") 
in view of in view of Carothers et al. (US Patent Application No. 2002/0016771 A1 , 
hereinafter "Carothers"). 

As to claim 1 , Nareddy teaches the claimed limitations: 

"A method for grouping log file entries by session" as a method and system for 
providing customers with access to and analysis of interaction or usage data (e.g., 
navigation data collected at customer web sites or computer program event information) 
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is provided. The data warehouse server may analyze low-level navigation events (e.g., 
each HTTP request that is received by the customer web site) to identify high-level 
events (e.g., a user session) (column 1 , lines 27-60). 

"Storing a log file of entries in a memory, each of said entries identifying a client 
request to a server" as the interaction or usage data, hereinafter interaction data or 
event data, may be stored in the log files and supplemented with data from other 
sources, such as product databases and customer invoices (column 1, lines 27-60). 

"Retrieving a subset of log file entries from the memory" as the retrieved category 
type definition information may already be separated into separate version groups. If it 
is possible to determine from the information received that a subset of the version 
groups will apply to all of the log entries in the log file, the routine could discard (or not 
initially retrieve) the definitions that are not in those version groups (column 49, lines 33- 
58). 

"Processing each entry in the memory to identify entries in the subset of log file 
entries that belong to a complete client session" as the parse log data routine that 
implements the main routine of parser in one embodiment. The routine processes each 
entry in the log file based on the parser configuration data. The routine filters out certain 
log entries, normalizes the attribute values of the log entries, and generates entries in 
the dimension tables for the attributes of the log entries. After processing all the log 
entries, the parser identifies user sessions and generates various statistics. The routine 
invokes the generate dimensions routine to update the dimension tables based on the 
selected log entry and to add an entry into the log entry fact table. The routine updates 
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the statistics for the log file. For example, the routine may track the number of log 
entries that have been filtered out. The routine then loops to select the next log entry, 
the routine outputs the log file statistics, then the routine invokes the identify sessions 
routine that scans the log entry table to identify the user sessions and updates a 
session dimension table and generate aggregate statistics routine to generate various 
statistics and then completes (column 13, lines 10-49). If multiple definitions are allowed 
or if the selected definition does not match the log entry, the routine continues to 
determine if there are more category type definitions in the selected version group. If 
multiple definitions are not allowed per log entry, the routine instead continues 
determine if there are more log entries to be processed. If so, the routine returns to 
select the next log entry for processing, If there are more log files, the routine continues, 
and if not then the routine continues and ends (column 49, lines 9-23). 

Nareddy does not explicitly teach the claimed limitation "grouping entries in the 
subset that belong to a complete client session". 

Carothers teaches each transaction entry is examined to determine a type of 
function for the transaction, each transaction encountered in the examination is written 
as a line to an output file, and all transactions encountered are grouped by transaction 
according to a data column of the transaction journal record that refers back to a 
session log record. The unique integer key value is assigned to each individual 
transaction record in the ASCII text output files and written to a pre-defined column in 
each output file for loading to the relational database system. In addition, transaction 
times are computed for each of the individual transaction records and added to the 
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corresponding output file (page 1 , paragraph 0010; see also figure 15, Session 
Summary Report). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made, having the teachings of Nareddy and Carothers before 
him/her, to modify Nareddy grouping entries in the subset that belong to a complete 
client session because that would provide a method for managing information 
concerning financial transactions for home banking and develops messages which go 
into the database easily and efficiently as taught by Carothers (page 1 , paragraph 
0004). 

As to claim 2, Nareddy teaches the claimed limitations: 

"A complete client session is identified by identifying all entries in the subset that 
are associated with a particular client session and that include both a beginning entry 
and an end entry" as if a customer requests a report showing information that includes a 
category type definition such as the customer specifies a date range for the report that 
begins before Jan. 31 , 2001 and ends after that date, it would be useful to indicate that 
the reason the data for the event after the date Jan. 31 , 2001 drops to zero is due to the 
new version of the web site rather than to a lack of customer interest in the digiMine 
data enhancement services. Alternately, reports that include such a category type 
definition could be limited by the user interface of the report requesting functionality to 
the effective dates of the category (column 45, line 8-20). 
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As to claim 3, Nareddy teaches the claimed limitations: 

"An end entry is identified as any entry that corresponds to a logout request" as 
Table 2 is an example portion of parser configuration data. The event type definitions 
map a site identifier, URI pattern, and query string pattern to an event type and value. 
EVENTDEFINITION= Logout, Logout, 1, [prefix]=/registration/logout.asp, ,. 

Also, Carothers teaches in order to minimize the effect of customer time-outs, for 
valid sessions that end due to a customer timeout, the session length of each of those 
sessions is reduced by a predetermined time (page 9, paragraph 0120; see also figure 
16). Sessions w/timeout-percent of all is the number of valid customer sessions that 
ended due to a session time out as a percentage of all valid sessions; sessions w/other 
end-count is the number of valid customer sessions that ended due to some reason 
other than a customer sign-off or timeout (page 10, paragraph 0125). 

As to claim 4, Nareddy teaches the claimed limitations: 

"An end entry for a client session is identified as any entry associated with that 
client session that has no other entries for that client session that occur within a session 
expiration window" as the identify sessions component processes the parsed log file 
data stored in the local data warehouse to identify user sessions. A user session 
generally refers to the concept of a series of web page accesses that may be related in 
some way, such as by temporal proximity (column 8, lines 52-60). This web page is 
shown displayed within a web browser display window. The displayed web page 
includes multiple frames that are each able to display different content, including a 
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control frame with various user-selectable controls and display frames in which 
customer-specific information is displayed. In the illustrated embodiment, the URL 
indication corresponds to the information displayed in the display frames. The path 
portion of the indicated URL specifies an executable Active Server Page program on the 
server that will supply the content displayed in the display frames, and the indicated 
URL also includes a query string portion that will be supplied as input to the executable 
program (column 21, lines 30-40). 

As to claim 5, Nareddy teaches the claimed limitation: 
"an end entry for a client session is identified as any entry having a first 
timestamp value, where the difference between first timestamp value and a second 
timestamp value associated with a subsequent entry in the subset of log files exceeds a 
timeout value" as the log file contains lines that are either directives or entries. An entry 
corresponds to a single HTTP transaction and consists of a sequence of fields (e.g., 
integer, fixed, URI, date, time, and string). The meaning of the fields in an entry is 
specified by a field directive specified in the log file (column 9, lines 12-25). 

Also, Carothers teaches in order to minimize the effect of customer time-outs, for 
valid sessions that end due to a customer timeout, the session length of each of those 
sessions is reduced by a predetermined time, such as 6 minutes (the standard session 
time out value). The time-out value is configurable by the business (page 9, paragraph 
01 20). Sessions w/timeout-percent of all is the number of valid customer sessions that 
ended due to a session time out as a percentage of all valid sessions; sessions w/other 
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end-count is the number of valid customer sessions that ended due to some reason 
other than a customer sign-off or timeout (page 10, paragraph 0125). 

As to claim 6, Nareddy does not explicitly teach the claimed limitation "outputting 
all entries in the subset of log file entries that do not belong to a complete client session 
as raw log data". 

Carothers teaches the definition of attempted transactions includes both 
successfully completed and unsuccessfully completed transactions. Successful 
transactions mean those home banking system functions/transactions that customers 
have successfully completed. Each successful transaction has a transaction completion 
activity log record with Completion Status Code=0 (Transaction successfully 
completed). Failed transactions mean transactions that have Completion Status Code 
(page 8, paragraph 0117; see also figure 14). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made, having the teachings of Nareddy and Carothers before 
him/her, to modify Nareddy log file entries that do not belong to a complete client 
session as raw log data because that would provide a method for managing information 
concerning financial transactions for home banking and develops messages which go 
into the database easily and efficiently as taught by Carothers (page 1 , paragraph 
0004). 
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As to claim 7, Nareddy does not explicitly teach the claimed limitation "outputting 
as raw log data all entries in the subset of log file entries that belong to an incomplete 
client session which has a beginning entry but no end entry". 

Carothers teaches successful financial transactions is the number of financial 
transactions that were attempted and completed successfully; successful non-financial 
transactions is the number of non-financial transactions that were attempted and 
completed successfully; and failed transactions is the number of both financial and non- 
financial transactions that were attempted but did not complete successfully (page 9, 
paragraph 0120). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made, having the teachings of Nareddy and Carothers before 
him/her, to modify Nareddy log file entries that belong to an incomplete client session 
because that would provide a method for managing information concerning financial 
transactions for home banking and develops messages which go into the database 
easily and efficiently as taught by Carothers (page 1 , paragraph 0004). 

As to claim 1 1 , Nareddy teaches the claimed limitations: 
"A system for session-based processing of log files using a data processing 
system and network session data collected from one or more users, the system 
comprising a log file collection system for collecting a plurality of server request entries, 
wherein a server request entry comprises a session identifier; a processing engine to 
process a subset of the plurality of server request entries to group the server request 
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entries by session using the session identifier in each server request entry" as the data 
processor component includes a parser, data storage area, and a loader. The data 
processor component inputs parser configuration data and a log file and updates the 
main data warehouse. The parser configuration data may include a mapping of actual 
web sites to logical sites and a mapping of a combination of Uniform Resource 
Identifiers (URIs) and query strings of the log entries to page definitions (e.g., 
categories) and event definitions. The parser processes the entries of the log file to 
generate facts and dimensions to eventually be stored in the main data warehouse. The 
parser identifies events in accordance with the parser configuration data. The parser 
includes a filter log entry component, a normalize log entry component, a generate 
dimensions component, an identify sessions component, and generate aggregate 
statistics component. The filter log entry component identifies which log entries should 
not be included in the main data warehouse. For example, a log entry that has an 
invalid format should not be included. The normalize log entry component normalizes 
the data in a log entry (column 8, lines 26-49; see also figure 3). 

the contained information for each entry further includes information related to a 
manner of identifying a web site server that responded to the request for that entry, 
wherein each of the interaction type definitions is associated with a logical site definition 
that specifies a manner of identifying a web site server related to the web site and that 
specifies times when that logical site definition is applicable (claim 29). 

Nareddy does not explicitly teach the claimed limitation "group the server request 
entries by session". 



Application/Control Number: 10/796,317 Page 12 

Art Unit: 2163 

Carothers teaches each transaction entry is examined to determine a type of 
function for the transaction, each transaction encountered in the examination is written 
as a line to an output file, and all transactions encountered are grouped by transaction 
according to a data column of the transaction journal record that refers back to a 
session log record. The unique integer key value is assigned to each individual 
transaction record in the ASCII text output files and written to a pre-defined column in 
each output file for loading to the relational database system. In addition, transaction 
times are computed for each of the individual transaction records and added to the 
corresponding output file (page 1 , paragraph 0010; see also figure 15, Session 
Summary Report). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made, having the teachings of Nareddy and Carothers before 
him/her, to modify Nareddy group the server request entries by session because that 
would provide a method for managing information concerning financial transactions for 
home banking and develops messages which go into the database easily and efficiently 
as taught by Carothers (page 1 , paragraph 0004). 

As to claim 13, Nareddy teaches the claimed limitations: 
"The processing engine uses a sliding memory window to process the subset of 
the plurality of web server request entries" as this web page is shown displayed within a 
web browser display window. The displayed web page includes multiple frames that are 
each able to display different content, including a control frame with various user- 
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selectable controls and display frames in which customer-specific information is 
displayed. In the illustrated embodiment, the URL indication corresponds to the 
information displayed in the display frames. The path portion of the indicated URL 
specifies an executable Active Server Page program on the server that will supply the 
content displayed in the display frames, and the indicated URL also includes a query 
string portion that will be supplied as input to the executable program (column 21 , lines 
30-40). 

As to claim 14, Nareddy teaches the claimed limitations: 
"A parser for further analysis the web server request entries that have been 
grouped by session to generate a user session history" as web sites typically collect 
extensive information on how its users use the site's web pages. This information may 
include a complete history of each HTTP request received by and each HTTP response 
sent by the web site. The web site may store this information in a navigation file, also 
referred to as a log file or click stream file (column 3, lines 25-35). 

As to claim 15, Nareddy teaches the claimed limitations: 

"the processing engine generates an output file containing web server request 
entries corresponding to one or more complete user sessions" as the higher level 
category of a web page may be identified using a mapping of web page URIs to 
categories. These categories may be stored in a category dimension table. Also, certain 
facts, such as the collection of log entries that comprise a single user web access 
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session or visit, may only is derivable by analyzing a series of log entries (column 6, 
lines 29-36). 

As to claim 16, Nareddy does not explicitly teach the claimed limitation "the 
processing engine generates an output file containing web server request entries 
corresponding to one or more incomplete user sessions". 

Carothers teaches successful non-financial transactions is the number of non- 
financial transactions that were attempted and completed successfully; and failed 
transactions is the number of both financial and non-financial transactions that were 
attempted but did not complete successfully (page 9, paragraph 0120). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made, having the teachings of Nareddy and Carothers before 
him/her, to modify Nareddy log file entries that belong to an incomplete client session 
because that would provide a method for managing information concerning financial 
transactions for home banking and develops messages which go into the database 
easily and efficiently as taught by Carothers (page 1 , paragraph 0004). 

As to claim 17, Nareddy does not explicitly teach the claimed limitation "the 
processing engine generates an output file containing web server request entries 
corresponding to one or more user sessions that do not include an end session entry". 

Carothers teaches the definition of attempted transactions includes both 
successfully completed and unsuccessfully completed transactions. Failed transactions 
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mean transactions that have Completion Status Code (page 8, paragraph 01 17; see 
also figure 14). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made, having the teachings of Nareddy and Carothers before 
him/her, to modify Nareddy log file entries that do not belong to a complete client 
session as raw log data because that would provide a method for managing information 
concerning financial transactions for home banking and develops messages which go 
into the database easily and efficiently as taught by Carothers (page 1 , paragraph 
0004). 

As to claim 18, Nareddy teaches the claimed limitations: 

"A system for parsing web site logs one session at a time, comprising: means for 
storing network session data from at least one server log file" as a system for providing 
customers with access to and analysis of interaction or usage data (e.g., navigation 
data collected at customer web sites or computer program event information) is 
provided. A data warehouse system collects customer data from the customer web sites 
and stores the data at a data warehouse server. The customer data may include 
application event data (e.g., click stream log files), user attribute data of users of the 
customer web site (column 5, lines 26-31). 

"Means for reading a subset of the network session data" as the subset of 
Internet sites that comprise the World Wide Web network also supports a standard 
protocol for requesting and receiving web page documents (column 1 , lines 44-46). 
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"Means for processing the subset of the network session data" as the data viewer 
may be a web browser, the data warehouse server includes a data receiver component, 
the data processor component, the data warehouse, and decision support system 
applications. The data receiver component receives customer data sent by the data 
collection components executing at the various customer web sites. The data processor 
component processes the customer data and stores it in the data warehouse. The 
decision support system application provides the customer with tools for analyzing and 
reviewing the customer data that is stored in the main data warehouse (column 7, lines 
7-17). 

"Means for generating a first output file containing network session data" as the 
customer servers and the data warehouse server are interconnected via the Internet. 
Customer components executing on a customer server includes a data collection 
component and a data viewer. The data viewer may reside on a client computer of the 
customer, rather than a server. The data collection component collects the customer 
data from the storage devices of the customer servers. The data viewer provides 
access for viewing of data generated by the decision support system applications of the 
data warehouse server (column 7, lines 3-12). 

"Means for parsing said first output file" as the data processor component may 
have a parser component and a loader component. The parser of the data processor 
parses and analyzes a log file and stores the resulting data in a local data warehouse 
that contains information for only that log file (column 6, lines 5-10). 

Nareddy does not explicitly teach the claimed limitation "grouped by session". 
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Carothers teaches each transaction entry is examined to determine a type of 
function for the transaction, each transaction encountered in the examination is written 
as a line to an output file, and all transactions encountered are grouped by transaction 
according to a data column of the transaction journal record that refers back to a 
session log record (page 1, paragraph 0010; see also figure 15, Session Summary 
Report). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made, having the teachings of Nareddy and Carothers before 
him/her, to modify Nareddy group by session because that would provide a method for 
managing information concerning financial transactions for home banking and develops 
messages which go into the database easily and efficiently as taught by Carothers 
(page 1 , paragraph 0004). 

As to claim 19, Nareddy teaches the claimed limitations: 
"means for reading a subset of the network session data comprises a sliding 
window" as this web page is shown displayed within a web browser display window. 
The displayed web page includes multiple frames that are each able to display different 
content, including a control frame with various user-selectable controls and display 
frames in which customer-specific information is displayed. In the illustrated 
embodiment, the URL indication corresponds to the information displayed in the display 
frames. The path portion of the indicated URL specifies an executable Active Server 
Page program on the server that will supply the content displayed in the display frames, 
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and the indicated URL also includes a query string portion that will be supplied as input 
to the executable program (column 21 , lines 30-40). 

4. Claims 8-10, 12 and 20 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Nareddy et al. (US Patent No. 7,107,338 B1) in view of in view of 
Carothers et al. (US Patent Application No. 2002/0016771 A1) and Dow et al. (US 
Patent Application No. 2004/0221311 A1 , hereinafter "Dow"). 
As to claim 8, Nareddy teaches the claimed limitations: 

"An article of manufacture having at least one recordable medium having stored 
thereon executable instructions and data which, when executed by at least one 
processing device, cause the at least one processing device" as a method, system and 
computer-readable medium for analyzing interaction or usage data, such as for 
customers (abstract). The data warehouse system includes customer components 
thatexecute on the customer servers and data warehouse components that execute on 
the data warehouse server. The customer servers and the data warehouse server are 
interconnected via the Internet (column 7, lines 1-5). 

"Scan each record in the ring buffer to identify a user session for said record and 
to identify any start or end records in the ring buffer" as the data warehouse server may 
analyze low-level navigation events (e.g., each HTTP request that is received by the 
customer web site) to identify high-level events (e.g., a user session). The data 
warehouse server then stores the converted data into a data warehouse (column 5, 
lines 56-61). The higher level category of a web page may be identified using a 
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mapping of web page URIs to categories. These categories may be stored in a category 
dimension table. Also, certain facts, such as the collection of log entries that comprise a 
single user web access session or visit, may only is derivable by analyzing a series of 
log entries (column 6, lines 25-36). 

Nareddy does not explicitly teach the claimed limitation "Read a plurality of 
records from a file system into a ring buffer, where said plurality or records comprises a 
subset of all records in the file system". 

Carothers teaches a system for managing information concerning financial 
transactions that produces reports, for example, of function usage and that enables 
grouping of certain functions by their category (page 1 , paragraph 0007). One or more 
transaction journal logs for one or more financial institution applications written in a pre- 
defined binary format are read to isolate a transaction message in a message buffer. 
The message contents are parsed out and written out into a flat-text file of SQL records 
into an output file loadable into a database re-using at least one Visual Basic class used 
for creating the transaction journal log, and the output file is stored in the database 
(page 1 , paragraph 001 1 ). The called method invokes an isolating the next transaction 
journal message API to position the next transaction message in the transaction journal 
log, read the transaction message contents, and insert the transaction message in a 
static buffer (e.g. ring buffer) (page 2, paragraph 0014). 

There are a number of definitions relevant to reporting. For example, for reporting 
purposes, users are categorized by their usage of the home banking system. FIG. 1 1 is 
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a table which shows examples of categories of users according to usage of a home 
banking system (page 8, paragraph 01 15). 

Although Nareddy teaches the routine creates a mapping of the local identifier 
(e.g., index into the local dimension table) of the selected entry to the main identifier 
(e.g., index into the main dimension table) for that selected entry (column 17, line 65 to 
column 18, line 3). 

Nareddy does not explicitly teach the claimed limitation "allocate, for each 
identified user session, an index to identify all records in the ring buffer that are 
associated with the identified user session and to identify all start or end records; and 
process the index to group all records in the ring buffer belonging to a complete user 
session, to output the grouped records for further analysis". 

Carothers teaches each transaction entry is examined to determine a type of 
function for the transaction, each transaction encountered in the examination is written 
as a line to an output file, and all transactions encountered are grouped by transaction 
according to a data column of the transaction journal record that refers back to a 
session log record (page 1, paragraph 0010; see also figure 15, Session Summary 
Report). 

Also, Dow teaches the event buffer module receives and aggregates events from 
an event index. In one embodiment, the event buffer receives selected events from the 
content navigator module that it has read from an index file. The event buffer module 
stores a plurality of events for analysis. In one embodiment, the event buffer module 
buffers event data for a set period of time, such as 2 minutes. For example, the event 
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buffer module may include a 2-minute ring buffer. In an alternate embodiment, the event 
buffer module buffers event data for an entire video program. In still another 
embodiment, the event buffer module stores a set number of events before the earliest 
stored event data is pushed off the event stack to make room for a new event. The 
other modules in the group detector module analyze the data stored by the event buffer 
module (page 14, paragraph 0112). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made, having the teachings of Nareddy, Carothers and Dow 
before him/her, to modify Nareddy process the index to group all records in the ring 
buffer belonging to a complete user session because that would provide improved 
navigation of video content recorded from a television broadcast and effective in quickly 
navigating through commercials as taught by Dow (page 2, paragraph 0010-001 1). 

As to claim 9, Nareddy teaches the claimed limitations: 

"the index comprises: a session record for each identified user session for keying 
into the ring buffer to identify log records associated with said identified user session" as 
When the data warehouse server receives customer data, it converts the customer data 
into a format that is more conducive to processing by decision support system 
applications used to analyze customer data. For example, the data warehouse server 
may analyze low-level navigation events (e.g., each HTTP request that is received by 
the customer web site) to identify high-level events (e.g., a user session). The data 
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warehouse server then stores the converted data into a data warehouse (column 5, 
lines 53-66). 

"a hash table for keying into the session record based upon session key 
information; a linked listing of last seen log records for each session; and a linked list of 
first seen log records for each session" as the higher level category of a web page may 
be identified using a mapping of web page URIs to categories. These categories may 
be stored in a category dimension table. Also, certain facts, such as the collection of log 
entries that comprise a single user web access session or visit, may only is derivable by 
analyzing a series of log entries (column 6, line 30-37). Each entry in a dimension table 
includes the attribute value (e.g., user identifier) and a hash value (column 14, lines 57- 
61). 

Each category includes a unique ID listed that corresponds to the IDs listed in 
table. In addition, hierarchy information for the categories is provided via column of 
table, in which each category can optionally have the ID of another category listed as its 
parent category (column 47, lines 45-55). If the content set is a web site, processing 
begins at the home web page for the web site, and the various links on the web pages 
of the web site are variously followed (or crawled) to identify all of the available web 
pages and the relationships indicating what web pages have links to what other web 
pages (column 51, lines 39-47). 



As to claim 10, Nareddy teaches the claimed limitations: 
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"the ring buffer implements a sliding window to process all of the log records in 
the file system into complete user sessions by sequentially adding and removing log 
records to the ring buffer until all of the log records in the file system have been 
processed" as this web page is shown displayed within a web browser display window. 
The displayed web page includes multiple frames that are each able to display different 
content, including a control frame with various user-selectable controls and display 
frames in which customer-specific information is displayed. In the illustrated 
embodiment, the URL indication corresponds to the information displayed in the display 
frames. The path portion of the indicated URL specifies an executable Active Server 
Page program on the server that will supply the content displayed in the display frames, 
and the indicated URL also includes a query string portion that will be supplied as input 
to the executable program (column 21 , lines 30-40). 

Nareddy does not explicitly teach the claimed limitation "the ring buffer". 

Dow teaches the event buffer module receives and aggregates events from an 
event index. In one embodiment, the event buffer receives selected events from the 
content navigator module that it has read from an index file. The event buffer module 
stores a plurality of events for analysis. In one embodiment, the event buffer module 
buffers event data for a set period of time, such as 2 minutes. For example, the event 
buffer module may include a 2-minute ring buffer (page 14, paragraph 0112). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made, having the teachings of Nareddy, Carothers and Dow 
before him/her, to modify Nareddy all records in the ring buffer belonging to a complete 



Application/Control Number: 10/796,317 Page 24 

Art Unit: 2163 

user session because that would provide improved navigation of video content recorded 
from a television broadcast and effective in quickly navigating through commercials as 
taught by Dow (page 2, paragraph 0010-0011). 

As to claim 12, Nareddy teaches the claimed limitations: 

"the processing engine uses a plurality of data structures to group the web server 
request entries by session, said plurality of data structures comprising: a per-session 
record for keying into the ring buffer, a hash table for keying into the per-session 
records, a linked list of last processed web server request entries for each session, and 
a linked list of first processed web server request entries for each session" as the parser 
component may separate the data parsing information entries into separate version 
groups before processing of the log entries. In addition, new versions of data parsing 
information can be used for reasons other than changes to a web site or other content 
set, such as a change in event types or category types of interest to a customer (column 
44, lines 60-67). These categories may be stored in a category dimension table. Also, 
certain facts, such as the collection of log entries that comprise a single user web 
access session or visit, may only is derivable by analyzing a series of log entries 
(column 6, line 30-37). Each entry in a dimension table includes the attribute value (e.g., 
user identifier) and a hash value (column 14, lines 57-61). This web page is shown 
displayed within a web browser display window. The displayed web page includes 
multiple frames that are each able to display different content (column 21 , lines 30-40). 
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Nareddy does not explicitly teach the claimed limitation "A ring buffer for storing 
the subset of the plurality of web server request entries". 

Dow teaches the event buffer module receives and aggregates events from an 
event index. In one embodiment, the event buffer receives selected events from the 
content navigator module that it has read from an index file. The event buffer module 
stores a plurality of events for analysis. In one embodiment, the event buffer module 
buffers event data for a set period of time, such as 2 minutes. For example, the event 
buffer module may include a 2-minute ring buffer (page 1 4, paragraph 01 1 2). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made, having the teachings of Nareddy, Carothers and Dow 
before him/her, to modify Nareddy all records in the ring buffer belonging to a complete 
user session because that would provide improved navigation of video content recorded 
from a television broadcast and effective in quickly navigating through commercials as 
taught by Dow (page 2, paragraph 0010-001 1). 

As to claim 20, Nareddy does not explicitly teach the claimed limitation "Means 
for reading a subset of the network session data comprises a ring buffer". 

Dow teaches the event buffer module receives and aggregates events from an 
event index. In one embodiment, the event buffer receives selected events from the 
content navigator module that it has read from an index file. The event buffer module 
stores a plurality of events for analysis. In one embodiment, the event buffer module 
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buffers event data for a set period of time, such as 2 minutes. For example, the event 
buffer module may include a 2-minute ring buffer (page 14, paragraph 0112). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made, having the teachings of Nareddy, Carothers and Dow 
before him/her, to modify Nareddy all records in the ring buffer belonging to a complete 
user session because that would provide improved navigation of video content recorded 
from a television broadcast and effective in quickly navigating through commercials as 
taught by Dow (page 2, paragraph 0010-0011). 
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